I tried the app out a few times and it never registered any data.
As far as I can tell, apps without a network permission don't access the internet like most apps do, but there are other ways to "use internet". Like, I see the app has a way to sync with Google Calendar. If the app triggers a sync, it's possible (but I don't know this for sure, it's just a guess) that since the sync was triggered by this app, that the system registers the app is the one using data.
The website does mention "indirect" ways to access the internet:
Revoking the permission denies indirect access via OS components and apps enforcing the INTERNET permission, such as DownloadManager. Direct access is denied by blocking low-level network socket access.
I don't know how GrapheneOS determines whether an app accesses the internet directly or indirectly, but I'd guess this app does so indirectly and GOS didn't add the network permission to this app for some reason.